Hey @ben10!
This is very odd behavior. Checked in with the team on this and the best guess is that Chrome is guessing that the pdf is malignant content for some reason. Can you try querying your dropbox URL with a REST query and passing the result directly to a PDF viewer?
Alternatively, if you're able to host the PDF somewhere that you can control CORS permissions and allow the Retool domain you should be able to display the file in the PDF component. Though I realize that may well be an unrealistic lift for this issue.